feat: add controlled source ingestion and replay

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118

migrations/versions/0002_controlled_source_and_operation_receipts.py

@@ -0,0 +1,47 @@
+"""Controlled source provenance and durable operation receipts.
+
+Revision ID: 0002
+Revises: 0001
+Create Date: 2026-08-22
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0002"
+down_revision = "0001"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("repositories", sa.Column("source_ref_json", sa.JSON(), nullable=True))
+    op.add_column("snapshots", sa.Column("source_provenance_json", sa.JSON(), nullable=True))
+    op.create_table(
+        "operation_receipts",
+        sa.Column("operation_key", sa.String(length=200), nullable=False),
+        sa.Column("request_fingerprint", sa.String(length=64), nullable=False),
+        sa.Column("snapshot_id", sa.String(length=36), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(
+            ["snapshot_id"],
+            ["snapshots.id"],
+            name=op.f("fk_operation_receipts_snapshot_id_snapshots"),
+            ondelete="RESTRICT",
+        ),
+        sa.PrimaryKeyConstraint("operation_key", name=op.f("pk_operation_receipts")),
+    )
+    op.create_index(
+        "ix_operation_receipts_snapshot",
+        "operation_receipts",
+        ["snapshot_id"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_operation_receipts_snapshot", table_name="operation_receipts")
+    op.drop_table("operation_receipts")
+    op.drop_column("snapshots", "source_provenance_json")
+    op.drop_column("repositories", "source_ref_json")